forked from akai/readest
Huang Xin
4ff96800d2
* ci(security): pin android-emulator-runner action by commit SHA Scorecard Pinned-Dependencies flagged the two reactivecircus/android-emulator-runner@v2 usages in android-e2e.yml as third-party actions not pinned by hash (code-scanning alerts #116, #117). Pin both to the full commit SHA the v2 tag currently resolves to (e89f39f = v2.37.0), matching the @<sha> # <version> convention already used by every other action in this workflow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(pull-request): shard web unit tests and split out test_extensions The jsdom unit suite was ~115s of the 280s test_web_app job — the slowest check on every PR. Split it across two parallel shards with vitest --shard, and move the browser-extension + koplugin tests into a new test_extensions job. - test_web_app: matrix shard [1, 2] running `vitest run --shard=N/2`; Playwright + browser tests run on shard 1 only. - test_extensions: extension tests + browser-ext build run always; the koplugin Lua tests (and their ~45s LuaJIT/busted install) run only when apps/readest.koplugin/** changed, detected via dorny/paths-filter (pinned by SHA; needs pull-requests: read to list PR files). - package.json: add test:pr:web:unit so CI can append --shard; test:pr:web still runs the full sequence locally. Cuts the PR critical path from ~280s toward ~188s (now build_tauri_app). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(pull-request): isolate koplugin lint + LuaJIT install into test_extensions build_web_app was the slowest PR job and installed LuaJIT + ran the koplugin syntax check on every PR. Move all koplugin tooling into test_extensions, gated on apps/readest.koplugin/** like the koplugin Lua tests already are: - build_web_app drops the LuaJIT install. - test_extensions installs LuaJIT/busted and runs `pnpm lint:lua` + `pnpm test:lua` only when the koplugin sources changed. - `pnpm lint` is now web-only (tsgo + biome); `lint:lua` stays a standalone script that test_extensions (and local koplugin work) calls directly. This also drops koplugin lint from the pre-push hook. - verification rule updated to match. Most PRs now skip the koplugin toolchain entirely. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>